Wiz says agent detection must start with model logs

Wiz published a blog post on 17 September 2026 setting out how it is building a detection engine intended to understand the intent behind AI agent behaviour. According to the company, the approach analyses model input and output logs inside what it calls an AI-native detection pipeline, with the goal of uncovering malicious AI agent activity.

The framing matters because it points at a gap that conventional security monitoring struggles with. Traditional detection looks at actions: a process that spawned, a file that was written, an API call that fired. An AI agent, by contrast, produces its actions as a by-product of text. The prompt it received, the reasoning text it produced and the tool call it emitted are all part of the same chain. Wiz's stated position, in the post's own summary, is that the model's inputs and outputs are the material you need to analyse in order to understand and uncover malicious agent behaviour.

That is a different telemetry source from the ones most security teams already collect. Cloud audit logs record that an identity called a service. They do not record the instruction that led the agent to make that call, or whether the instruction came from the operator, from a user, or from text the agent read somewhere along the way. Reading the model layer is an attempt to recover that missing context.

The word "intent" is doing significant work in Wiz's title, and it is worth being precise about what it can and cannot mean here. A detection engine reading logs is inferring intent from text, not observing it. The same tool call can be legitimate in one context and hostile in another, and the difference may live entirely in a prompt written by someone other than the agent's owner. Any system that classifies agent behaviour from model logs is therefore making a judgement call, with the usual consequences for false positives and false negatives.

The published summary of the post does not detail what detection logic the engine uses, what coverage it offers across model providers or agent frameworks, how the logs are collected, or whether the capability is generally available to Wiz customers. It does not give performance figures or examples of attacks caught in production. Readers evaluating the approach will need the full post, and ideally independent testing, before drawing conclusions about how well intent inference works against real adversaries.

The broader signal is about where vendors think the monitoring boundary is moving. If agent actions originate in text, then the security-relevant record is increasingly the conversation itself rather than the infrastructure events downstream of it. That has implications for log retention, for privacy, and for who in an organisation is expected to review model transcripts. Wiz's post is one vendor's answer to that problem rather than an industry standard.